Unauthenticated OS Command Injection in Dell Unity
CVE-2025-36604 is an unauthenticated remote OS command injection vulnerability affecting Dell Unity family products, including Dell Unity, UnityVSA, and Unity XT, running Dell Unity Operating Environment (OE) version 5.5 and earlier. The flaw is caused by improper neutralization of special elements in input that is incorporated into operating system command construction. Supporting reporting indicates the issue is tied to login redirection handling in UnityVSA: when authentication state is absent and the request is routed into the login flow, a user-controlled redirect URI can be passed into logic such as getCASURL and, when the type parameter is set to "login," concatenated into a command executed via Perl backticks without sufficient sanitization. An attacker can supply crafted input containing shell metacharacters or command separators to trigger arbitrary command execution on the appliance.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
No valid public exploits. Mallory filtered out 1 candidate as fakes, detection scripts, or README-only repos.
All candidate exploits were filtered out by Mallory's validation.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical pre-authenticated command injection vulnerability in Dell UnityVSA that could result in remote command execution.
A vulnerability in Dell UnityVSA, listed as a trending CVE for the week. No further details provided.
Unauthenticated command injection / remote command execution in Dell UnityVSA caused by improper sanitization of a user-controlled login redirect URI that is concatenated into a command executed via Perl backticks.
A pre-authentication command injection vulnerability in Dell UnityVSA virtual storage appliance, patched as part of a broader firmware update.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.